Slashdot Mirror

← Back to Stories (view on slashdot.org)

First Ever Malvertising Campaign Uses JavaScript To Mine Cryptocurrencies In Your Browser (bleepingcomputer.com)

Posted by BeauHD on from the first-of-its-kind dept.

An anonymous reader writes from a report via Bleeping Computer: Malware authors are using JavaScript code delivered via malvertising campaigns to mine different cryptocurrencies inside people's browsers (mostly Monero), without their knowledge. The way crooks pulled this off was by using an online advertising company that allows them to deploy ads with custom JavaScript code. The JavaScript code is a modified version of MineCrunch (also known as Web Miner), a script released in 2014 that can mine cryptocurrencies using JavaScript code executed inside the browser. Cryptocurrency mining operations are notoriously resource-intensive and tend to slow down a user's computer. To avoid raising suspicion, crooks delivered malicious ads mainly on video streaming and browser-based gaming sites (currently mostly Ukrainian and Russian sites). Both types of sites use lots of resources, and users wouldn't get suspicious when their computer slowed down while accessing the site. Furthermore, users tend to linger more on browser games and video streaming services, allowing the mining script to do its job and generate profits for the crooks.

6 of 70 comments (clear)

  1. Got to say by Anonymous Coward · · Score: 5, Informative

    Genius.

    Despite being one of the causes of adblocker proliferation it's a nice change from the usual destructive malware in ads.

    Must admit I've never really understood why advertising companies allow advertisers to run potentially unsafe code via their network. Surely it reflects badly on them and I'm too ignorant to understand the need for custom code with an advert.

    1. Re:Got to say by Nutria · · Score: 5, Insightful

      And Javascript isn't exactly known for its high performance when it comes to maths.

      That was my first thought. People spend so much on top-tier GPUs for mining, and these guys go for JS.

      I bet the malware guys are using this as a proof-of-concept for something else.

      --
      "I don't know, therefore Aliens" Wafflebox1
  2. Could we find a legitimate use for this idea? by 91degrees · · Score: 4, Interesting

    Micropayments have never caught on because they're a pain to deal with. People might be willing to spend some of their CPU time though. They don't object too much to doing the millions of operations required for a few seconds of video (the objection is more the annoyance of the video itself)

    I suspect CPU time is not valuable enough to make this sort of thing viable but maybe I'm wrong.

    1. Re:Could we find a legitimate use for this idea? by hord · · Score: 4, Interesting

      There are tons of distributed projects where people donate CPU time. It has value for communities of people that like to work on common computational goals. Examples are SETI, distributed.net, and folding@home. Here is Wikipedia's list:

      https://en.wikipedia.org/wiki/...

      I ran a Pentium 200MHz overclocked to 250MHz for several years straight (along with many other machines) trying to crack RC5-64 years ago. Lots of fun.

    2. Re:Could we find a legitimate use for this idea? by 91degrees · · Score: 4, Interesting

      Yup, and those are great. I approve of the aspirational ideals.

      But I'm thinking of the more commercial aspects. For example, while I have no complaints about CGI movies, I'm not going to donate my CPU time to help make one. A company might be willing to pay me a fraction of a cent for rendering a few pixels though. I don't want that fraction of a cent. I do, however, want to be able to read websites without annoying popup ads. The website owner, with thousands of impressions per page per day would like that fraction of a cent for each page.

      So the computer animation company pays the website some money to run a few seconds rendering time on my PC. I get the web-page for a negligible increase in power costs, and the computer animation company gets some pixels. Multiply that by a few hundred thousand users. They all get the information they want, the computer animation company gets several frames rendered, and the website owner gets money.

  3. Re: Crooks? by Boutzev · · Score: 5, Insightful

    If an ad runs on your computer without authorization - it uses your computer's resources too. Is that somehow different just because ads waste less resources than mining ? What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?

    While I don't agree with anyone running code on a user's station without authorization, there isn't much difference between this and a common ad. Both should be illegal if you ask me. But if those guys are crooks - then what would Google Adwords be ?